Anomaly detection electronic control unit, onboard network system, and anomaly detection method

ABSTRACT

An anomaly detection electronic controller performs anomaly detection processing and is connected to a bus, which a plurality of electronic controllers use for communication to communicate following a Controller Area Network (CAN) protocol. The anomaly detection electronic controller includes an anomaly detection processor that performs anomaly detection processing regarding a data frame. The anomaly detection controller also includes an anomaly detection processing requester that decides an anomaly detection processing timing in accordance with a state of a vehicle in which the bus is installed when receiving the data frame, the anomaly detection processing timing being a reception timing of one or multiple fields in the data frame. The anomaly detection processor further performs the anomaly detection processing regarding the data frame at the anomaly detection processing timing decided by the anomaly detection processing requester.

This is a continuation of U.S. application Ser. No. 15/228,299, filedAug. 4, 2016, which is a continuation of International PatentApplication No. PCT/JP2015/005668, filed on Nov. 13, 2015, which claimsthe benefit of U.S. Provisional Patent Application No. 62/085,744, filedDec. 1, 2014, and the benefit of Japanese Patent Application No.2015-196430, filed Oct. 2, 2015. The disclosure of each of theabove-identified applications, including the specification, drawings,and claims, is incorporated herein by reference in its entirety.

BACKGROUND 1. Technical Field

The present invention relates to technology for detecting unauthorizedframes transmitted over an onboard network by which an electroniccontrol unit performs communication.

2. Description of the Related Art

In recent years, a great number of electronic control units (ECU) havebeen placed in systems in automobiles. A network connecting these ECUsis referred to as an onboard network. Many standards exist for onboardnetworks. The most mainstream of these is a standard called ControllerArea Network (CAN), that is stipulated in ISO11898-1.

A CAN is configured using two busses, and each ECU connected to thebuses is called a node. Each node connected to a bus transmits/receivesmessages called frames. A transmitting node that transmits a frameapplies voltage to the two busses, and generates potential differencebetween the busses, thereby transmitting a value “1” called recessive,and a value “0” called dominant. In a case where multiple transmittingnodes transmit recessive and dominant at exactly the same timing, thedominant is transmitted with priority. In a case where there is anabnormality in the format a received frame, a receiving node transmits aframe called an error frame. An error frame is a continuous transmissionof six bits, thereby notifying the transmitting node and other receivingnodes that there is an abnormality.

No identifiers indicating the transmission destination or transmissionsource exist in CAN, with the transmitting node attaching an identifier(ID) to each frame and transmitting (i.e., sending out signals to thebus), and the receiving nodes only receiving frames of a predeterminedID (i.e., reading signals from the bus). The Carrier Sense MultipleAccess/Collision Avoidance (CSMA/CA) format is employed, so whenmultiple nodes transmit at the same time, arbitration by message ID isperformed, with frames having a smaller message ID value beingtransmitted with higher priority.

There is a threat to onboard CAN network systems in that an attackermight unauthorizedly control an ECU by accessing the bus andtransmitting unauthorized frames, and security measures are beingstudied.

For example, the onboard network monitoring system described in JapaneseUnexamined Patent Application Publication No. 2013-131907 monitorsframes flowing over the CAN bus, and transmits warning information in acase where an unauthorized frame is detected. An ECU which has receivedthe warning information is forbidden from control according to theunauthorized frame.

SUMMARY

In one general aspect, the techniques disclosed here feature an anomalydetection electronic control unit that performs anomaly detectionprocessing and that is connected to a bus which a plurality ofelectronic control units use for communication to communicate followinga CAN protocol. The anomaly detection electronic control unit includesan anomaly detection processing requester that decides an anomalydetection processing timing based on an ID of a data frame acquired fromthe bus, and an anomaly detection processer that performs anomalydetection processing regarding the data frame at the anomaly detectionprocessing timing decided by the anomaly detection processing requester.

According to the present disclosure, instead of performing uniformmonitoring of each data frame transmitted over the bus to ensuresecurity, anomaly detection processing is performed at timings inaccordance with IDs of frames, so efficient detection of unauthorizedframes can be realized.

It should be noted that general or specific embodiments may beimplemented as a system, a method, an integrated circuit, a computerprogram, a storage medium, or any selective combination thereof.

Additional benefits and advantages of the disclosed embodiments willbecome apparent from the specification and drawings. The benefits and/oradvantages may be individually obtained by the various embodiments andfeatures of the specification and drawings, which need not all beprovided in order to obtain one or more of such benefits and/oradvantages.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a diagram illustrating the overall configuration of an onboardnetwork system according to a first embodiment;

FIG. 2 is a diagram illustrating a format of a data frame stipulated inthe CAN protocol;

FIG. 3 is a diagram illustrating a format of an error frame stipulatedin the CAN protocol;

FIG. 4 is a configuration diagram of an anomaly detection ECU accordingto the first embodiment;

FIG. 5 is a diagram illustrating an example of correlated informationstored in an anomaly detection processing timing holding unit of theanomaly detection ECU according to the first embodiment;

FIG. 6 is a diagram illustrating an example of anomaly detection rulesstored in an anomaly detection rule holding unit of the anomalydetection ECU according to the first embodiment;

FIG. 7 is a configuration diagram of an ECU according to the firstembodiment;

FIG. 8 is a diagram illustrating an example of a processing sequence atthe time of reception of a data frame by the anomaly detection ECUaccording to the first embodiment;

FIG. 9 is a flowchart illustrating data frame reception processing atthe anomaly detection ECU according to the first embodiment;

FIG. 10 is a diagram illustrating the overall configuration of anonboard network system according to a second embodiment;

FIG. 11 is a configuration diagram of an anomaly detection ECU accordingto the second embodiment;

FIG. 12 is a diagram illustrating an example of information foridentifying timing for anomaly detection processing, which the anomalydetection ECU according to the second embodiment uses;

FIGS. 13A through 13D are diagrams illustrating an example of tablesused to decide a monitoring level by the anomaly detection ECU accordingto the second embodiment;

FIG. 14 is a diagram illustrating an example of anomaly stateinformation held in an anomaly state holding unit of the anomalydetection ECU according to the second embodiment;

FIG. 15 is a diagram illustrating an example of vehicle stateinformation held in a vehicle state holding unit of the anomalydetection ECU according to the second embodiment;

FIG. 16 is a diagram illustrating an example of monitoring levelinformation held in a monitoring level holding unit of the anomalydetection ECU according to the second embodiment;

FIG. 17 is a diagram illustrating an example of change in operations ofthe anomaly detection ECU according to the second embodiment (change inaccordance with change in state of vehicle);

FIG. 18 is a diagram illustrating an example of change in operations ofthe anomaly detection ECU according to the second embodiment (change inaccordance with change in increase in number of times of anomalydetection);

FIG. 19 is a flowchart illustrating an example of processing at the timeof reception of a data frame by the anomaly detection ECU according tothe second embodiment; and

FIG. 20 is a flowchart illustrating processing performed by a monitoringlevel deciding unit of the anomaly detection ECU according to the secondembodiment.

DETAILED DESCRIPTION Underlying Knowledge Forming Basis of the PresentInvention

Now, a situation where excessive monitoring for the threat ofunauthorized frames leads to excessive electric power consumption of theonboard network system including the monitoring device is undesirable.

Accordingly, in order to prevent increased electric power consumptionwhile ensuring security of the onboard network system, the presentdisclosure provides an anomaly detection electronic control unit(anomaly detection ECU), which is an ECU that is capable of efficientlyexecuting anomaly detection processing to detect transmission ofunauthorized frames. The present disclosure also provides an onboardnetwork system having the ECU that efficiently performs anomalydetection processing, and an anomaly detection method used by in theonboard network system to efficiently detect unauthorized frames.

An anomaly detection electronic control unit according to one aspect ofthe present disclosure is an anomaly detection electronic control unitthat performs anomaly detection processing and that is connected to abus which a plurality of electronic control units use for communicationto communicate following a CAN protocol. The anomaly detectionelectronic control unit includes: an anomaly detection processingrequester that decides an anomaly detection processing timing based onan ID of a data frame acquired from the bus; and an anomaly detectionprocesser that performs anomaly detection processing regarding the dataframe at the anomaly detection processing timing decided by the anomalydetection processing requester. Accordingly, anomaly detectionprocessing is performed at a timing based on the ID of the data frame,so efficient detection of unauthorized frames can be realized.

The anomaly detection electronic control unit may further include: amicrocontroller that is a semiconductor integrated circuit including amicroprocessor that executes a program; and a controller that is asemiconductor integrated circuit that is connected to themicrocontroller and that realizes functions of the anomaly detectionprocessing requester. The microprocessor realizes the functions of theanomaly detection processer by performing the anomaly detectionprocessing in correlation with an interruption request signal byexecuting the program, and the anomaly detection processing requestersends out the interruption request signal to the microprocessor at thedecided anomaly detection processing timing. Accordingly, aninterruption request signal is notified to the processor of themicrocontroller when the anomaly detection processing timing arrives, sono anomaly detection processing is performed by the processor until theinterruption request signal is input, and may be in alow-power-consumption state (sleep state) or the like. Accordingly,ensuring security can be realized while relatively suppressing electricpower consumption.

The anomaly detection electronic control unit may further include ananomaly detection processing timing holder that holds correlationinformation, in which a timing is correlated with each of one or moreIDs. The anomaly detection processing requester makes the decision, witha timing correlated with the ID of the data frame acquired from the busin the correlation information as the anomaly detection processingtiming. Accordingly, IDs of data frames which are important from theperspective of security and IDs of data frames which are have lessimportance can be set to different anomaly detection processing timingsin correlation information, so that unauthorized frames can beefficiently detected in accordance with importance.

The correlation information may have the reception timing of one or aplurality of particular fields in a data frame correlated with thetiming, for each of the one of more IDs, and the anomaly detectionelectronic control unit may send an error frame to the bus in a casethat the anomaly detection processer detects an anomaly in the anomalydetection processing performed at a receipt timing of the particularfield. One of the one or plurality of particular fields may be one of anID field, a data length code (DLC) field, and a data field. According tothese, with regard to IDs of data frames which are important from theperspective of security, anomaly detection processing is performed atthe reception timing of a particular field (e.g., ID field, DLC field,data field, etc.), and control or the like of the ECU corresponding tothe unauthorized frame can be prevented by sending out an error frameupon an anomaly being detected.

The anomaly detection electronic control unit may further include ananomaly state holder that holds anomaly state information, which isupdated so as to indicate, regarding each of the plurality of IDsaccording to the correlation information, a number of times of detectionof anomalies in the anomaly detection processing already performedregarding data frames having that ID. With regard to each of theplurality of IDs, the greater the number of times of detection ofanomalies regarding that ID is in the anomaly state information, themore reception timings of the particular fields the anomaly detectionprocessing timing holder correlates that ID with in the correlationinformation. Accordingly, the monitory frequency is raised in a casewhere the number of anomalies detected increases, so handling ofanomalies can be performed more speedily, for example.

The anomaly detection processing requester may perform the deciding ofthe anomaly detection processing timing in accordance with the detectionresults of anomalies in the anomaly detection processing that hasalready been performed. Accordingly, the number of times of detection ofanomalies can be reflected in the anomaly detection processing timing,so effective monitoring (i.e., execution of anomaly detectionprocessing) such as raising the monitoring frequency only in a casewhere a certain level or more of anomalies has occurred, for example,can be performed.

The anomaly detection processing requester may perform the deciding ofthe anomaly detection processing timing in accordance with a state of avehicle in which the bus is installed. Accordingly, efficient detectionof unauthorized frames is realized in a case where the importance ofsecurity of a data frame including a particular ID changes in relationwith the state of the vehicle.

An arrangement may be made where, if the ID of the data frame is a firstvalue, the anomaly detection processing requester performs the decidingsuch that the anomaly detection processing timing is a timing whenreceiving the data frame, and if the ID of the data frame is a secondvalue that is different from the first value, performs the deciding suchthat the anomaly detection processing timing is a timing aftercompletion of receiving the data frame, and in a case of having detectedan anomaly in the anomaly detection processing performed by the anomalydetection processer at the timing of receiving the data frame, theanomaly detection electronic control unit sends out an error frame ontothe bus. Accordingly, in a case where the necessity of anomaly detectiondiffers for each data frame ID, such as whether to speedily detect andprevent an anomaly, or whether to perform comprehends inspectionregarding the anomaly, anomaly detection processing can be realized inaccordance with the necessity. For example, if anomaly detectionprocessing is performed with the timing of while receiving the dataframe as the anomaly detection processing timing, an unauthorized dataframe can be overwritten and invalidated by sending out an error frameat the time of detecting an anomaly. Also, if anomaly detectionprocessing is performed with the timing of completion of receiving thedata frame as the anomaly detection processing timing, the content ofeach part of the ID field, DLC, data field, and so forth within the dataframe can be inspected at this one timing, so efficient anomalydetection can be realized.

The anomaly detection electronic control unit may further include memorythat stores the program. Also, the anomaly detection electronic controlunit may further include a hard disk device that stores the program.

An onboard network system according to one aspect of the presentdisclosure is an onboard network system including a plurality ofelectronic control units that communicate via a bus following a CANprotocol. The onboard network system includes: an anomaly detectionprocessing requester that decides an anomaly detection processing timingbased on an ID of a data frame acquired from the bus; and an anomalydetection processer that performs anomaly detection processing regardingthe data frame at the anomaly detection processing timing decided by theanomaly detection processing requester. This enables realization of anonboard network system where power consumption is efficiently suppressedby performing anomaly detection at a timing based on the ID of the dataframe.

An anomaly detection method according to one aspect of the presentdisclosure is an anomaly detection method used in an onboard networksystem including a plurality of electronic control units thatcommunicate via a bus following a CAN protocol. The method includes:deciding an anomaly detection processing timing based on an ID of a dataframe acquired from the bus; and performing anomaly detection processingregarding the data frame at the decided anomaly detection processingtiming. Accordingly, anomaly detection processing can be efficientlyperformed at a timing based on the ID of the data frame.

These general or specific aspects may be realized by a system, method,integrated circuit, computer program, or computer-readable recordingmedium such as a CD-ROM, and may be realized by any combination of asystem, method, integrated circuit, computer program, and recordingmedium.

The following is a detailed description of an onboard network systemaccording to embodiments with reference to the drawings. Note that theembodiments described below are all specific examples of the presentdisclosure. Accordingly, values, components, placements and connectedstates of components, steps (processes) and the order of steps, and soforth illustrated in the following embodiments, are only exemplary, anddo not restrict the present disclosure. Components in the followingembodiments which are not included in an independent Claim are optionalcomponents. The drawings are all schematic diagrams and are notnecessarily created in an exact manner.

First Embodiment

An anomaly detection method used in an onboard network system 10 wheremultiple ECUs communicate via a bus will be described as an embodimentof the present disclosure, with reference to the diagrams. The anomalydetection method is primarily executed by an anomaly detection ECUconnected to the bus. The anomaly detection ECU has a function to decidea timing at which a processor (microprocessor) is to execute a controlprogram for the anomaly detection processing (processing to distinguishwhether a frame that has appeared on the bus is an unauthorized frame ornot), in accordance with a data frame being received, and thus realizesefficient anomaly detection.

1.1 Overall Configuration of Onboard Network System 10

FIG. 1 is a diagram illustrating the overall configuration of theonboard network system 10 according to the first embodiment. The onboardnetwork system 10 is an example of a network communication system thatcommunicates according to the CAN protocol, and is a networkcommunication system onboard an automobile in which various types ofdevices have been installed, such as a control device, sensor, actuator,and so forth. The onboard network system 10 has multiple devices thatperform communication relating to frames via the bus, using the anomalydetection method. Specifically, the onboard network system 10 includes abus 300, an anomaly detection ECU 100, and nodes which are ECUs such asECUs 200 a and 200 b connected to various types of devices and to thebus, as illustrated in FIG. 1. Note that many other ECUs besides theanomaly detection ECU 100 and ECUs 200 a and 200 b are included in theonboard network system 10, but description will be made focusing on theanomaly detection ECU 100 and ECUs 200 a and 200 b, for sake ofconvenience. An ECU (e.g., the anomaly detection ECU 100, ECUs 200 a and200 b, etc.) is a device that includes, for example, digital circuitssuch as a processor (microprocessor), memory, and so forth, analogcircuits, communication circuits, and so forth. The memory is read-onlymemory (ROM), random access memory (RAM), and so forth, capable ofstoring a control program (computer program) to be executed by theprocessor.

Alternatively, an ECU may include a hard disk device excluded fromillustration, for example. Further, a control program (computer program)may be stored in the hard disk device. Part or all of the functions ofthe components of the ECU can be realized by software, by the processoroperating following the control program (computer program), for example.A computer program is configured as a combination of multiple commandcodes representing instructions to the processor, to achievepredetermined functions.

The ECUs 200 a and 200 b are connected to the bus 300, and respectivelyconnected to a sensor 210 and an actuator 220. Examples of the sensor210 include an acceleration sensor, steering angle sensor, and so forth.Examples of the actuator 220 include a brake actuator, and so forth. TheECU 200 a acquires the state of the sensor 210 and includes the acquiredinformation in a data frame, and sends the data frame out onto the bus300. The ECU 200 b receives the data frame sent out onto the bus 300 bythe ECU 200 a, and controls the actuator 220 according to theinformation relating to the state of the sensor 210 included in thatdata frame.

The anomaly detection ECU 100 is a type of ECU connected to the bus 300,and has a function of monitoring frames flowing over the bus (i.e.,frames appearing on the bus), and performs anomaly detection processingto distinguish whether or not unauthorized frames (i.e., frames that donot meet rules decided beforehand) are flowing over the bus 300.

The ECUs on the onboard network system 10 exchange frames following theCAN protocol. Frames in the CAN protocol include data frames, remoteframes, overload frames, and error frames. Description will be madeprimarily here regarding data frames and error frames.

1.2 Data Frame Format

The following is a description of a data frame which is a type of frameused on a network according to the CAN protocol. FIG. 2 is a diagramillustrating a format of a data frame stipulated by the CAN protocol.FIG. 2 illustrates a data frame according to a standard ID formatstipulated in the CAN protocol. A data frame is configured including thefields of a start of frame (SOF), ID field, remote transmission request(RTR), identifier extension (IDE), reserved bit “r”, data length code(DLC), data field, cyclic redundancy check (CRC) sequence, CRC delimiter“DEL”, acknowledgement (ACK) slot, ACK delimiter “DEL”, and end of frame(EOF).

The SOF is made up of 1-bit dominant. The state of the bus is recessivewhen idle, and start of transmission of a frame is notified by beingchanged to dominant by the SOF.

The ID field is made up of 11 bits, and is a field storing an ID whichis a value indicating the type of data. Design has been implemented sothat in a case where multiple nodes start transmission at the same time,frames with smaller ID values are given higher priority, in order toperform communication arbitration using this ID field.

The RTR is a value identifying a data frame and remote frame, and ismade up of 1-bit dominant in a data frame.

The IDE and “r” are each made up of 1-bit dominant.

The DLC is made up of four bits, and is a value indicating the length ofthe data field. The four bits that store the value of the DLC in thedata frame are also called the DLC field.

The data field is a maximum of 64 bits, and is a value indicating thecontent of the data being transmitted. The length can be adjusted in8-bit increments. The CAN protocol does not stipulate the specificationof data being transmitted; that is set at the onboard network system 10.Accordingly, the specification is dependent on the model, manufacturer(manufacturing maker), or the like.

The CRC sequence (“CRC” illustrated in FIG. 2) is made up of 15 bits.This is calculated from the transmitted values of the SOF, ID field,control field, and data field.

The CRC delimiter (the “DEL” between the “CRC” and “ACK” in FIG. 2) ismade up of 1-bit recessive, and is a sectioning symbol representing theend of the CRC sequence. The CRC sequence and CRC delimiter arecollectively referred to as the CRC field.

The ACK slot (the “ACK” in FIG. 2) is made up of one bit. Thetransmitting node performs transmission with the ACK slot set torecessive. The receiving node transmits the ACK slot as dominant if upto the CRC sequence has been received normally. Dominant has higherpriority than recessive, so if the ACK slot is dominance aftertransmission, so the transmitting node will be able to confirm that oneof the receiving nodes has succeeded in reception of the ACK slot isdominant after transmission.

The ACK delimiter (the “DEL” between the “ACK” and “EOF” in FIG. 2) ismade up of 1-bit recessive, and is a sectioning symbol representing theend of the ACK.

The EOF is made up of 7-bits recessive, and represents the end of thedata frame.

1.3 Error Frame Format

FIG. 3 is a diagram illustrating the format of the error framestipulated in the CAN protocol. An error frame is made up of an errorflag (primary), error flag (secondary), and an error delimiter.

The error flag (primary) is used to notify occurrence of an error toother nodes. A node which has detected an error transmits sixconsecutive bits dominant to notify other nodes of the occurrence of theerror. This transmission violates the bit stuffing rule in the CANprotocol (that six bits or more of the same value are not to beconsecutively transmitted), and causes other nodes to transmit an errorframe (secondary).

The error flag (secondary) is made up of six consecutive bits dominant,used to notify occurrence of an error to the other nodes. All nodes thathave received the error flag (primary) and detected the violation of thebit stuffing rule will transmit the error flag (secondary).

The error delimiter “DEL” is an 8-bit consecutive recessive, andindicates the end of the error frame.

1.4 Configuration of Anomaly Detection ECU 100

FIG. 4 is a configuration diagram of the anomaly detection ECU 100. Theanomaly detection ECU 100 is configured including a transceiver unit130, a controller unit 140, and a microcontroller unit 150.

The transceiver unit 130 is an electronic circuit such as acommunication circuit or the like. The transceiver unit 130 convertsframes notified from the controller unit 140 into electric signals thatcan be transmitted onto the bus 300, and transmits. The transceiver unit130 also receives electric signals appearing on the bus 300, and therebynotifies the controller unit 140 of the content of the frame receivedone bit at a time.

The controller unit 140 is a semiconductor integrated circuit thatincludes a digital circuit and memory and so forth, and that exchangessignals with the microcontroller unit 150 and transceiver unit 130. Thecontroller unit 140 includes a protocol processing unit 141, an anomalydetection processing requesting unit 142, an unauthorized frame judgingunit 143, and an anomaly detection processing timing holding unit 144.

The protocol processing unit 141 performs communication with thetransceiver unit 130, and carries out processing following a protocol(CAN protocol or the like). In a case of having detected an error in aframe being received, for example, the protocol processing unit 141notifies the transceiver unit 130 of transmission of an error frame(i.e., a transmission request), to cause the transceiver unit 130 totransmit an error frame. In a case of having completed transmission ofthe data frame, the protocol processing unit 141 notifies themicrocontroller unit 150 of completion of reception of the data frame.In response to a data frame transmission request from themicrocontroller unit 150, the protocol processing unit 141 notifies thetransceiver unit 130 so as to be able to transmit the data frame inaccordance with the protocol. The protocol processing unit 141 alsonotifies the anomaly detection processing requesting unit 142 of thecontent notified from the transceiver unit 130. In a case of beingnotified by the unauthorized frame judging unit 143 of transmission ofan error frame (i.e., a transmission frame), the protocol processingunit 141 notifies the transceiver unit 130 of the transmission of theerror frame. The protocol processing unit 141 also temporarily holds thecontent of the data frame that has appeared on the bus 300, acquired viathe transceiver unit 130, and if requested by the microcontroller unit150 for information such as the ID, DLC, data, and so forth, that arenecessary for anomaly detection processing, hands the requestedinformation to the microcontroller unit 150. The protocol processingunit 141 further calculates the difference between the previous time ofreception of a data frame and the time of reception this time, and ifrequested for timing notification information relating to the receptiontiming, that is the calculation results thereof and so forth, hand thattiming notification information to the microcontroller unit 150.

The anomaly detection processing requesting unit 142 is notified of adata frame being received by the protocol processing unit 141,references the anomaly detection processing timing holding unit 144during reception of the data frame, and decides the anomaly detectionnotification timing in accordance with the data frame being received(specifically, the ID of the frame). The anomaly detection processingrequesting unit 142 then notifies an anomaly detection processing unit154 of the microcontroller unit 150 of an anomaly detection processingrequest signal, at the point that the decided anomaly detectionprocessing timing has arrived.

The unauthorized frame judging unit 143 acquires the detection resultsregarding an anomaly in the anomaly detection processing by the anomalydetection processing unit 154 of the microcontroller unit 150, and In acase of having detected an anomaly, notifies the protocol processingunit 141 of transmission of an error frame.

The anomaly detection processing timing holding unit 144 holdscorrelation information correlating multiple IDs with respective timings(see FIG. 5), in a storage medium (also called recording medium) or thelike. A storage medium is, for example, memory included in the anomalydetection ECU 100 (e.g., controller unit 140).

The microcontroller unit 150 is a semiconductor integrated circuitincluding a processor (microprocessor) that exchanges signals with thecontroller unit 140 and executes a program, and memory. The program isstored in the memory of the semiconductor integrated circuit, forexample. Alternatively, in a case where the anomaly detection ECU 100includes a hard disk device omitted from illustration, the program maybe recorded in the hard disk device. The microcontroller unit 150functions by executing this program. The microcontroller unit 150includes, as functional components realized by the processor thatexecutes the program, the memory, and so forth, a controllercommunication unit 151, a frame processing unit 152, a frame generatingunit 153, the anomaly detection processing unit 154, and an anomalydetection rule holding unit 155.

The controller communication unit 151 notifies the frame processing unit152 of the data frame received from the controller unit 140. Thecontroller communication unit 151 notifies the controller unit 140 of adata frame notified from the frame generating unit 153, and performs adata frame transmission request. The controller communication unit 151receives an acquisition request notification for information necessaryfor anomaly detection processing from the anomaly detection processingunit 154, and acquires, from the controller unit 140, the ID (i.e., thecontent of the ID field), the DLC (content of DLC field), data (contentof data field), and timing notification information relating to thereception timing of the data frame, that are necessary for the anomalydetection processing.

The frame processing unit 152 processes the data frame notified from thecontroller communication unit 151.

The frame generating unit 153 notifies the controller communication unit151 of a transmission request for a data frame.

The anomaly detection processing unit 154 performs anomaly detectionprocessing upon receiving an anomaly detection processing request signalfrom the anomaly detection processing requesting unit 142 of thecontroller unit 140. For example, the anomaly detection processingrequest signal is given as an interruption request signal to theprocessor of the microcontroller unit 150. If the processor is executinga program for example, the processor discontinues the execution thereofin response to the interruption request signal, and executes aparticular interruption-handling processing program determinedbeforehand, thereby realizing the primary function of the anomalydetection processing unit 154, which is to perform anomaly detectionprocessing. If there is no need to execute any program in particular,the processor may go to a low-power-consumption state (sleep state), ifthe interruption request signal (anomaly detection processing requestsignal) is received in this state, the processor cancels the sleep,returns to the normal power consumption state, and executes anomalydetection processing. The anomaly detection processing is processing todetermine whether or not a frame sent out onto the bus 300, i.e., aframe which has appeared on the bus 300, is an unauthorized frame. Thatis to say, this is processing to determine whether or not the frame doesnot match predetermined rules. This determination is performed based onanomaly detection rules (see FIG. 6) which the anomaly detection ruleholding unit 155 holds.

The content of the anomaly detection processing is determined beforehandfor each data frame ID regarding which determination is to be made forwhether anomaly or not (e.g., stipulated by anomaly detection rules),correlated with anomaly detection processing timing set for each ID bycorrelation information or the like, for example. That is, the anomalydetection processing unit 154 performs the following inspection asanomaly detection processing according when it operates by having beennotified of an anomaly detection processing request signal. In a casewhere the anomaly detection processing unit 154 operates by having beennotified of an anomaly detection processing request signal whenreceiving an ID in a data frame (i.e., when receiving the ID field),inspection is performed to determine whether or not the ID in the dataframe being received (the value of the ID field) is an unauthorized ID(i.e., an unauthorized frame) as the anomaly detection processing,according to whether or not the ID is not stipulated in the anomalydetection rules in the anomaly detection rule holding unit 155. Further,in this case, if the anomaly detection rules stored in the anomalydetection rule holding unit 155 stipulate rules regarding cycles,inspections is performed to determine whether or not the time fromreceiving the last data from to the time of reception of the data framethis time matches the cycle stipulated in the rules, thereby determiningwhether or not an unauthorized cycle (i.e., an unauthorized frame).

Also, in a case where the anomaly detection processing unit 154 operatesby having been notified of an anomaly detection processing requestsignal when receiving a DLC in a data frame (i.e., when receiving theDLC field), inspection is performed to determine whether or not anunauthorized DLC (i.e., unauthorized frame) according to whether or notthe DLC of the data frame being received differs from the DLC stipulatedin the anomaly detection rules.

Also, in a case where the anomaly detection processing unit 154 operatesby having been notified of an anomaly detection processing requestsignal when receiving data in a data frame (i.e., when receiving thedata field), inspection is performed to determine whether or notunauthorized data (i.e., unauthorized frame) according to whether or notthe values of the data field being received differ from the valuesstipulated in the anomaly detection rules.

Also, in a case where the anomaly detection processing unit 154 operatesby having been notified of an anomaly detection processing requestsignal after completion of reception of the data frame, inspection isperformed to determine whether or not unauthorized the aforementionedunauthorized ID, unauthorized cycle, unauthorized DLC, and unauthorizeddata, thereby determining whether or not an unauthorized frame. Notethat for anomaly detection processing, an inspection may be maderegarding consistency of data, in which determination is made that theframe is unauthorized in a case where the data value changes from a datavalue in the previous data frame by an predetermined amount of change ormore.

After having performed the anomaly detection processing, the anomalydetection processing unit 154 notifies the unauthorized frame judgingunit 143 of the controller unit 140 regarding the results of the anomalydetection processing, indicating whether or not an anomaly has beendetected. Note that the anomaly detection processing unit 154 acquiresinformation necessary for the anomaly detection processing bytransmitting an acquisition request notification to the controllercommunication unit 151 regarding one or more of the ID (i.e., thecontent of the ID field), the DLC (content of DLC field), data (contentof data field), and timing notification information relating to thereception timing of the data frame, that are necessary for the anomalydetection processing.

The anomaly detection rule holding unit 155 holds anomaly detectionrules (see FIG. 6) to be referenced by the anomaly detection processingunit 154 in the storage medium (also called recording medium) or thelike. The storage medium is, for example, memory included in the anomalydetection ECU 100 (e.g., microcontroller unit 150) for example.

Note that in a case where anomaly of a frame has been detected at theanomaly detection processing unit 154 or the unauthorized frame judgingunit 143, log information relating to the unauthorized frame (e.g.,content of frame, date-and-time of reception, etc.) may be recorded inthe storage medium or the like, and control for notification of theanomaly (display, transmission of information to an external server,etc.) may be performed.

1.5 Correlation Information

FIG. 5 illustrates a list as an example of correlation information whichthe anomaly detection processing timing holding unit 144 holds. Thecorrelation information is information where multiple IDs and respectivetimings (anomaly detection processing timings) have been correlated, andis used to decide the timing at which the anomaly detection processingrequesting unit 142 makes notification of an interruption request signal(anomaly detection processing request signal). The correlationinformation in the list exemplified in FIG. 5 is the reception timing ofone or multiple particular fields (ID field, DLC field, data field,etc.) in the data frame, correlated as anomaly detection processingtiming with each of the one or more IDs. This example indicates that thetiming of notification (occurrence) of an anomaly detection processingrequest signal differs depending on the ID of the data frame beingreceived.

In a case where a data frame with an ID 0x100 is received, the anomalydetection processing requesting unit 142 generates an anomaly detectionprocessing request signal to serve as an interruption request signal forthe processor of the microcontroller unit 150 at the time of receivingthe ID of the data frame (when the ID field is received), and requeststhe anomaly detection processing unit 154 to execute anomaly detectionprocessing. In the same way, an anomaly detection processing requestsignal is generated at both timings of when receiving the ID andreceiving data (when the data field is received) for a data frame withan ID 0x200, and an anomaly detection processing request signal isgenerated at both timings of when receiving the ID and receiving the DLC(when the DLC field is received) for a data frame with an ID 0x400. Onthe other hand, no anomaly detection processing request signal isgenerated for a data frame with an ID 0x300. With regard to IDs notincluded in the list exemplarily illustrated in FIG. 5, the anomalydetection processing requesting unit 142 generates an anomaly detectionprocessing request signal after completion of reception of the dataframe. This means the same as correlation information having beenstipulated correlating the IDs not included in the list in FIG. 5 with atiming after completion of reception of the data frame (e.g., at thetime of completion of reception of the data frame), for example. Notethat an arrangement may be made regarding IDs for which no anomalydetection processing request signal is to be generated, where these IDsare not included in the list, and information correlating the IDs ofdata frames regarding which anomaly detection processing is to beperformed after completion of reception of the data frame with a timingafter completion of reception of the data frame (e.g., at the time ofcompletion of reception of the data frame), as the correlationinformation.

1.6 Anomaly Detection Rules

FIG. 6 illustrates a list as an example of anomaly detection rules thatthe anomaly detection rule holding unit 155 holds. Anomaly detectionrules are information where each of multiple IDs are correlated withinspection contents for detection of anomalies, used by the anomalydetection processing unit 154 at the time of performing inspection thatis the content of anomaly detection processing. The list exemplarilyillustrated in FIG. 6 has each of one or more IDs correlated withreference information that indicates normal values for the items of DLC,data, and cycle. The reference information is used in the inspectionfor, for example, matching with a bit string acquired by reception ofpart of a data frame. “None” is listed for items that are not used ininspection for anomaly detection in the example in FIG. 6, andinspection relating to these items are not performed in the anomalydetection processing.

In the example in FIG. 6, the normal value for DLC of a data frame wherethe ID is 0x100 is “none”, so no inspection is performed regarding DLC,the normal value for data is “none” (meaning that no inspection isperformed regarding data), and the normal value of cycle, thatrepresents the reception cycle of the data frame, is 20 ms. The normalvalue for DLC of a data frame where the ID is 0x200 is “none” so noinspection is performed regarding DLC, the normal value for data is thatthe highest order byte is 0x20, and the normal value of cycle is “none”so no inspection is performed regarding “cycle”. The normal value forDLC of a data frame where the ID is 0x400 is 2, and the normal value fordata and cycle is “none” so no inspection is performed regarding data.Note that the anomaly detection rule holding unit 155 may hold thecontents of the list regarding anomaly detection rules in an encryptedform. The anomaly detection processing unit 154 does not have toidentify all contents of the anomaly detection processing that theanomaly detection processing unit 154 performs based on the listregarding anomaly detection rules, and an arrangement may be made wherenormal values for one or more item of ID, DLC, data, and cycle are heldin the list as anomaly detection rules. The contents of anomalydetection processing determined by the anomaly detection rules, program,and so forth, are not restricted to the examples illustrated here.

1.7 Configuration of ECU 200 a

FIG. 7 is a configuration diagram of the ECU 200 a. The ECU 200 a isconfigured including the transceiver unit 130, a controller unit 240,and a microcontroller unit 250.

The transceiver unit 130 is the same as the transceiver unit 130 of theanomaly detection ECU 100 (illustrated in FIG. 4), so description willbe omitted.

The controller unit 240 is a semiconductor circuit including a digitalcircuit and a storage medium such as memory or the like, that exchangessignals with the microcontroller unit 250 and transceiver unit 130. Thecontroller unit 240 includes a protocol processing unit 241. Thecontroller unit 240 does not include the anomaly detection processingrequesting unit 142 and the unauthorized frame judging unit 143, unlikethe controller unit 140 of the anomaly detection ECU 100.

The protocol processing unit 241 performs communication with thetransceiver unit 130, and carries out processing following a protocol(CAN protocol or the like). In a case of having detected an error in aframe being received, for example, the protocol processing unit 241notifies the transceiver unit 130 of transmission of an error frame(i.e., a transmission request), to cause the transceiver unit 130 totransmit an error frame. In a case where transmission of the data framehas been completed, the protocol processing unit 241 notifies themicrocontroller unit 250 of completion of reception of the data frame.The protocol processing unit 241 notifies the transceiver unit 130 so asto be able to transmit, in response to a data frame transmission requestfrom the microcontroller unit 250, the data frame in accordance with theprotocol.

The microcontroller unit 250 is a semiconductor integrated circuitincluding a processor that exchanges signals with the controller unit240 and executes a program, and memory. The microcontroller unit 250includes, as functional components realized by the processor thatexecutes the program, the memory, and so forth, the controllercommunication unit 151, a frame processing unit 252, a frame generatingunit 253, and an external device input/output unit 254.

The controller communication unit 151 is the same as the controllercommunication unit 151 of the anomaly detection ECU 100 (see FIG. 4).Note however, that the controller communication unit 151 does notcollaborate with the anomaly detection processing unit 154 that themicrocontroller unit 250 does not have. That is to say, the controllercommunication unit 151 notifies a data frame received from thecontroller unit 240 to the frame processing unit 252. The controllercommunication unit 151 notifies the controller unit 240 of the dataframe notified from the frame generating unit 253, and makes a dataframe transmission request.

The frame processing unit 252 processes the data frame transmitted fromthe controller communication unit 151, and notifies the external deviceinput/output unit 254 of the results.

The frame generating unit 253 generates a data frame based on the valuesnotified from the external device input/output unit 254, and notifiesthe controller communication unit 151 of the data frame.

The external device input/output unit 254 performs communication with anexternal device connected to the ECU 200 a. That is to say, the externaldevice input/output unit 254 acquires sensor information from the sensor210, and notifies this to the frame generating unit 253.

The ECU 200 b has the same configuration as the ECU 200 a. Note however,that the external device input/output unit 254 of the ECU 200 b outputscontrol information, based on the values notified from the frameprocessing unit 252, to the actuator 220 connected to the ECU 200 b,thereby controlling the actuator 220.

1.8 Sequence Relating to Collaborative Operations of Parts of AnomalyDetection ECU 100 when Receiving Data Frame

The following is a description of an example of operations of theanomaly detection ECU 100 that is connected to the bus 300 and carriesout the anomaly detection method, in a case where an unauthorized ECUhas accessed the bus 300 of the onboard network system 10 having theabove-described configuration, and has transmitted a data frame of whichthe ID is 0x100.

FIG. 8 is a sequence diagram illustrating an example of collaborativeoperations of the parts of the anomaly detection ECU 100 in a case ofhaving received an unauthorized data frame. Assumption will be made thatthe anomaly detection processing timing holding unit 144 of the anomalydetection ECU 100 holds the list exemplarily illustrated in FIG. 5 ascorrelation information, and the anomaly detection rule holding unit 155holds the list exemplarily illustrated in FIG. 6 as anomaly detectionrules. Assumption will also be made that the anomaly detection ECU 100has received the data frame of which the ID is 0x100 10 ms ago. Thesequence diagram in FIG. 8 illustrates the operations relating totransmission of signals among the anomaly detection processingrequesting unit 142, anomaly detection processing unit 154, unauthorizedframe judging unit 143, and protocol processing unit 141 by arrows. Theoperations at each of the parts are indicated by rectangular blocksdownwards from above following the flow of time.

Upon the data frame of which the ID is 0x100 is transmitted to the bus300, the protocol processing unit 141 of the controller unit 140 of theanomaly detection ECU 100 receives the ID of that data frame (i.e.,0x100, which is the value of the ID field) from the bus 300 via thetransceiver unit 130 (Step S1001). The protocol processing unit 141 thathas received the ID notifies the anomaly detection processing requestingunit 142 of the ID (received ID) of the data frame being received (stepS1002).

The anomaly detection processing requesting unit 142 references thecorrelation information that the anomaly detection processing timingholding unit 144 holds, and decides an anomaly detection processingtiming corresponding to the ID that has been notified (step S1003).According to the example of correlation information in FIG. 5, thetiming of receiving the ID, that corresponds to the 0x100 which is theID of the received data frame, is decided to be the anomaly detectionprocessing timing.

The anomaly detection processing requesting unit 142 requests executionof anomaly detection processing by inputting an interruption requestsignal (anomaly detection processing request signal) to the processor ofthe microcontroller unit 150 at the point that the anomaly detectionprocessing timing decided in step S1003 arrives (step S1004). Theexecution timing of the anomaly detection processing is controlled bythe timing of transmission of the interruption request signal from thecontroller unit 140 to the microcontroller unit 150 (interruption at theprocessor). If the anomaly detection processing timing is at the time ofID reception, an anomaly detection processing request signal(interruption request signal) is immediately notified to the anomalydetection processing unit 154, since it is the time of reception of theID. Note that if the anomaly detection processing timing that has beendecided is the time of reception of the DLC for example, the anomalydetection processing request signal is notified to the anomaly detectionprocessing unit 154 after having awaited for the time at which the DLCis received. If the anomaly detection processing timing that has beendecided is the time of completion of reception of the data frame forexample, the anomaly detection processing request signal is notified tothe anomaly detection processing unit 154 after having awaited for thetime at which reception of the data frame is completed.

Upon receiving the interruption request signal, the processor in themicrocontroller unit 150 executes the interruption-handling processingprogram, whereby the anomaly detection processing unit 154 executesanomaly detection processing (step S1005). In the anomaly detectionprocessing, the anomaly detection processing unit 154 transmits anacquisition request notification to the protocol processing unit 141 ofthe controller unit 140 for acquisition of the ID received from the bus300 and timing notification information relating to reception cycle, viathe controller communication unit 151 (step S1005 a). In response tothis, the anomaly detection processing unit 154 receives the ID andtiming notification information that the protocol processing unit 141transmits, via the controller communication unit 151 (step S1005 b). Theanomaly detection processing unit 154 inspects the acquired ID andtiming notification information in the anomaly detection processing,based on the anomaly detection rules. The acquired ID is determined inthis inspection to be a normal ID, since it is included in the listserving as anomaly detection rules in FIG. 6, but the reception timingthat the timing notification information indicates has elapsed 10 msfrom the previous reception, for example, which is different from the 20ms stipulated in the list of anomaly detection rules in FIG. 6, andaccordingly is distinguished as being an unauthorized cycle.Accordingly, the anomaly detection processing unit 154 notifies theunauthorized frame judging unit 143 of the controller unit 140 that anunauthorized frame has been detected, as the results of the anomalydetection processing (step S1006).

Upon having received the results of the anomaly detection processing,the unauthorized frame judging unit 143 distinguishes whether or not ananomaly has been detected in the anomaly detection processing (stepS1007), and in a case where an anomaly has been detected in the anomalydetection processing, notifies (makes a transmission request to) theprotocol processing unit 141 of transmission of an error frame (stepS1008).

In a case where transmission of an error frame has been notified fromthe unauthorized frame judging unit 143, the protocol processing unit141 notifies the transceiver unit 130 of transmission (transmissionrequest) of an error frame (step S1009). Accordingly, the transceiverunit 130 sends an error frame out onto the bus 300. The remainingportion of the data frame partway through being transmitted over the bus300 (the data frame regarding which the ID is 0x100 and as far as the IDfield has been transmitted) is overwritten by the error frame so as tosay, with the error frame made up of consecutive dominants being givenpriority over recessives. Accordingly, the ECUs 200 a and 200 bconnected to the bus 300 can be prevented from operating in response tothe unauthorized data frame (unauthorized operations). This alsoprevents the ECUs 200 a and 200 b from consuming electric powerunnecessarily due to operating in response to the unauthorized dataframe. Note that the above example, the anomaly detection ECU 100transmits an error frame if an anomaly is detected, since the anomalydetection processing is being performed at the time of ID reception, butif anomaly detection is performed at the time of completion of receptionof the data frame, no error frame is transmitted, and control may bemade such as recording log information, annunciation of an anomaly, andso forth, for example.

1.9 Processing at Time of Anomaly Detection ECU 100 when Receiving DataFrame

Processing performed at the time of the anomaly detection ECU 100receiving a data frame will be described with reference to the flowchartin FIG. 9. The anomaly detection ECU 100 receives up to the ID field ofthe data frame from the bus 300, thereby acquiring the ID field of thedata frame (step S1101).

The anomaly detection ECU 100 references the correlation informationheld by the anomaly detection processing timing holding unit 144 usingthe anomaly detection processing requesting unit 142, and decides theanomaly detection processing timing corresponding to the acquired ID ofthe data frame (step S1102). Accordingly, one or multiple of whenreceiving the ID, when receiving the DLC, when receiving data, and whenreception of the data frame is completed, is decided as the anomalydetection processing timing in accordance with the received ID.

The anomaly detection ECU 100 determines whether or not the decidedanomaly detection processing timing has arrived (step S1103) using theanomaly detection processing requesting unit 142. If the anomalydetection processing timing has not arrived, determination is maderegarding whether or not reception of the data frame has been completed(Step S1104), and if not completed, the next one bit appearing on thebus 300 is received by the protocol processing unit 141 and so forth(step S1105) and the flow returns to the determination in step S1103.Upon reception of the data frame being completed, the anomaly detectionECU 100 notifies completion of reception of the data frame to themicrocontroller unit 150, using the protocol processing unit 141. Ifreception of the data frame is completed in the determination in stepS1104, the anomaly detection ECU 100 ends the processing performed whenreceiving a data frame.

In a case where determination is made in step S1103 that the anomalydetection processing timing has arrived, the anomaly detection ECU 100inputs an interruption request signal (anomaly detection processingrequest signal) to the processor of the microcontroller unit 150 fromthe anomaly detection processing requesting unit 142 of the controllerunit 140, thereby executing anomaly detection processing based onanomaly detection rules using the anomaly detection processing unit 154(step S1106).

In a case of detecting an anomaly as a result of the anomaly detectionprocessing by the anomaly detection processing unit 154 while receivinga data frame (step S1107), the anomaly detection ECU 100 sends out anerror frame onto the bus 300, thereby performing transmission of theerror frame (Step S1108). In a case where the results of the anomalydetection processing are normal (a case where no anomaly was detected),or in a case where an anomaly is detected as the result of anomalydetection processing after the data frame has been received, the anomalydetection ECU 100 does not transmit an error frame, and rather performsthe determination in step S1104.

The processing illustrated in FIG. 9 is repeatedly performed each timethe ID of a data frame is received. For example, if the ID of the dataframe is a first value (e.g., 0x100, 0x200, etc.), the anomaly detectionprocessing requesting unit 142 decides the anomaly detection processingtiming to be the timing when receiving the data frame. If the ID of thedata frame is a second value that is different from the first value(e.g., 0x500, etc.), the anomaly detection processing timing is decidedto be the timing after receiving the data frame (e.g., when reception ofthe data frame is completed). In this case, the anomaly detection ECU100 sends an error frame out onto the bus 300 when an anomaly isdetected in the anomaly detection processing performed by the anomalydetection processing unit 154 at the timing of when receiving the dataframe, but does not send out an error frame when an anomaly is detectedin the anomaly detection processing performed at the timing of afterreceiving the data frame. Deciding the anomaly detection processingtiming in this way is useful in a case where the data frame including anID of the first value necessitates speedy anomaly detection for securityreasons, and where the data frame including an ID of the second valuedoes not necessitate speedy anomaly detection.

1.10 Advantages of First Embodiment

In the onboard network system 10 according to the first embodiment, theanomaly detection ECU 100 decides an anomaly detection processing timingin accordance with the ID of a received data frame, based on correlationinformation held in the anomaly detection processing timing holding unit144, and performs anomaly detection processing at the decided anomalydetection processing timing. Accordingly, instead of performing uniformmonitoring for each data frame transmitted over the bus 300 to ensuresecurity, anomaly detection processing is performed at suitable timingsin accordance with the IDs of the data frames, so efficient detection ofunauthorized frames can be realized. For example, deciding correlationinformation with two or more of when receiving ID, when receiving DLC,and when receiving data, correlated in accordance with an ID of a dataframe that is important from a security perspective, enables several ofID, data frame reception cycle, DLC, and data (content of data field) tobe speedily inspected. Other ECUs can then be speedily prevented fromperforming unauthorized operations and the like, by transmitting anerror frame when an anomaly is detected. When the anomaly detectionprocessing timing arrives, the processor of the microcontroller unit 150is notified by an interruption request signal from the controller unit140, so the processor can remaining at a low-power-consumption state(sleep state), for example, until the interruption request signal isinput, and can return to the low-power-consumption state if noprocessing is necessary after the anomaly detection processing ends.Also, by deciding correlation information corresponding to the ID of aframe of which importance is relatively low, so as to be correlatedafter receipt of the data frame is completed, the ID, data framereception cycle, DLC, data (content of data field), and so forth can beinspected in a single anomaly detection processing after completion ofreception of the data frame, so security can be ensured with suppressedelectric power consumption.

Second Embodiment

An onboard network system 11, which is a partial modification of theonboard network system 10 illustrated in the first embodiment, will bedescribed below. The anomaly detection ECU 100 of the onboard networksystem 10 according to the first embodiment decides the anomalydetection processing timing for executing the anomaly detectionprocessing to detect anomalies regarding data frames transmitted overthe bus 300 in accordance with the ID of the data frame. In contrastwith this, the onboard network system 11 according to the presentembodiment has an anomaly detection ECU 2100 that decides the anomalydetection processing timing in accordance with not only the ID of thedata frame, but also the state of the vehicle in which the onboardnetwork system 11 including the bus 300 and so forth is installed, andthe state of anomaly (i.e., the results of the anomaly detectionprocessing). The anomaly detection ECU 2100, which is a partialmodification of the anomaly detection ECU 100, decides the anomalydetection processing timing in accordance with a monitoring level, thatis identified from the ID of the data frame, the state of the vehicle,and the state of anomaly.

2.1 Overall Configuration of Onboard Network System 11

FIG. 10 is a diagram illustrating the overall configuration of theonboard network system 11 according to the second embodiment. Theonboard network system 11 is configured including the bus 300, and nodesconnected to the bus such as the ECUs like the anomaly detection ECU2100, and ECUs 200 a, 200 b, and 2200 c and so forth, as illustrated inFIG. 10. Components which have the same functions as those in the firstembodiment are denoted by the same reference numerals, and descriptionthereof will be omitted. The onboard network system 11 is the same asthe onboard network system 10 with regard to points that are notillustrated in particular in the present embodiment.

The ECU 2200 c is connected to the bus 300, and also connected to abattery 2230 and vehicle speed sensor 2240. By acquiring informationfrom these, the ECU 2200 c can identify which of stopped, charging,driving, and high-speed driving the current state of the vehicle is, andsend a data frame indicating the identified state of the vehicle outonto the bus 300. Stopped here means a state where the vehicle speed iszero and other than charging (charging of the battery 2230). Drivingmeans a state where the vehicle is running but not at high speed.Driving at high speed indicates a state where the vehicle speed is at acertain speed (e.g., 60 Km/hour) or faster. The ECU 2200 c has the sameconfiguration as the ECU 200 a, so description will be omitted here (seeFIG. 7). The battery 2230 is a power source for supplying electric powerto the ECUs and so forth.

The anomaly detection ECU 2100 is a partial modification of the anomalydetection ECU 100 (see FIG. 4) is connected to the bus 300, and has afunction of monitoring frames flowing over the bus, and performs anomalydetection processing to distinguish whether or not unauthorized framesare flowing over the bus 300.

2.2 Configuration of Anomaly Detection ECU 2100

FIG. 11 is a configuration diagram of the anomaly detection ECU 2100.The anomaly detection ECU 2100 is configured including the transceiverunit 130, a controller unit 2140, and a microcontroller unit 2150.Components which have the same functions as in the first embodiment aredenoted by the same reference numerals, and description thereof will beomitted.

The controller unit 2140 is a partial modification of the controllerunit 140, and is a semiconductor integrated circuit that includes adigital circuit and memory and so forth, and that exchanges signals withthe microcontroller unit 2150 and transceiver unit 130. The controllerunit 2140 includes a protocol processing unit 2141, the anomalydetection processing requesting unit 142, the unauthorized frame judgingunit 143, and the anomaly detection processing timing holding unit 144.

The protocol processing unit 2141 has, in addition to the functions ofthe protocol processing unit 141 illustrated in the first embodiment, afunction of updating correlation information which the anomaly detectionprocessing timing holding unit 144 holds in a case where the controllercommunication unit 151 notifies an update request of the anomalydetection processing timing holding unit 144.

The microcontroller unit 2150 is a semiconductor integrated circuitincluding a processor that exchanges signals with the controller unit2140 and executes a program, and memory. The program is stored in thememory of the semiconductor integrated circuit, for example.Alternatively, in a case where the anomaly detection ECU 2100 includes ahard disk device omitted from illustration, the program may be recordedin the hard disk device. The microcontroller unit 2150 functions by theprocessor executing this program. The microcontroller unit 2150includes, as functional components realized by the processor thatexecutes the program, the memory, and so forth, the controllercommunication unit 151, a frame processing unit 2152, the framegenerating unit 153, an anomaly detection processing unit 2154, theanomaly detection rule holding unit 155, a monitoring level decidingunit 2156, an anomaly state holding unit 2157, a vehicle state holdingunit 2158, and a monitoring level holding unit 2159.

The frame processing unit 2152 processes a data frame notified from thecontroller communication unit 151. As an example of processing of a dataframe, the frame processing unit 2152 analyzes a data frame notifiedfrom the ECU 2200 c to acquire the state of the vehicle, and storesvehicle state information indicating the state of the vehicle in thevehicle state holding unit 2158. In a case of having updated the vehiclestate information, the frame processing unit 2152 notifies themonitoring level deciding unit 2156 to the effect that the vehicle stateinformation has been updated.

The anomaly detection processing unit 2154 is a partial modification ofthe anomaly detection processing unit 154, and receives anomalydetection processing request signals from the controller unit 2140 andperforms anomaly detection processing. For example, the anomalydetection processing request signal is given as an interruption requestsignal to the processor of the microcontroller unit 2150. What isincluded in the anomaly detection processing is the same as the anomalydetection processing performed by the anomaly detection processing unit154 in the first embodiment. After having performed the anomalydetection processing, the anomaly detection processing unit 2154notifies the unauthorized frame judging unit 143 of the controller unit2140 of the results of anomaly detection processing, indicating whetheror not an anomaly was detected. The anomaly detection processing unit2154 transmits to the controller communication unit 151 one or more ofthe ID (i.e., the content of the ID field), the DLC (content of DLCfield), data (content of data field), and timing notificationinformation relating to the reception timing of the data frame, that arenecessary for the anomaly detection processing, thereby acquiringinformation necessary for the anomaly detection processing. The anomalydetection processing unit 2154 also has a function of acquiring thecurrent time. In a case where determination is made of an unauthorizedframe as the result of the anomaly detection processing, the anomalydetection processing unit 2154 updates the number of times of detectionof this ID in anomaly state information (see FIG. 14) stored in theanomaly state holding unit 2157 (also called anomaly occurrence count),and the latest update time. At this time, if there is a time differencebetween the last update time before updating the anomaly occurrencecount and the current time that is a certain level or longer, theanomaly occurrence count is reset to zero. In a case of having updatedthe anomaly state information, the anomaly detection processing unit2154 notifies the monitoring level deciding unit 2156 that the anomalystate information has been updated.

The monitoring level deciding unit 2156 references the anomaly stateholding unit 2157 and vehicle state holding unit 2158 when the anomalydetection processing unit 2154 notifies that the anomaly stateinformation has been updated and when the frame processing unit 2152notifies that the vehicle state information has been updated, anddecides the monitoring level for each ID. The monitoring level decidingunit 2156 compares the decided monitoring level and the monitoring levelup to now that monitoring level information held in the monitoring levelholding unit 2159 indicates, and if these do not agree, the monitoringlevel information is updated to indicate the decided monitoring level.In a case of having updated the monitoring level information, themonitoring level deciding unit 2156 notifies an update request via thecontroller communication unit 151 so as to rewrite the anomaly detectionprocessing timing in the correlation information that the anomalydetection processing timing holding unit 144 of the controller unit 2140holds, based on anomaly detection processing timing identifyinginformation (see FIG. 12) in accordance with the monitoring level. Themonitoring level deciding unit 2156 decides the monitoring level basedon the table (correlation table) exemplarily illustrated in FIGS. 13Athrough 13D, for example. This method of deciding the monitoring levelwill be described later.

The anomaly state holding unit 2157 holds the anomaly state information(see FIG. 14) indicating the state of anomaly found from the results ofthe anomaly detection processing performed by the anomaly detectionprocessing unit 2154. Specifically, the anomaly state information isinformation that is updated to indicate the number of anomalies detected(anomaly occurrence count) in the anomaly detection processing alreadyperformed for each data frame ID (each ID correlated with an anomalydetection processing timing by correlation information).

The vehicle state holding unit 2158 holds the vehicle state information(see FIG. 15) indicating the state of the vehicle that the frameprocessing unit 2152 has acquired from data frames transmitted from theECU 2200 c.

The monitoring level holding unit 2159 holds monitoring levelinformation (see FIG. 16) indicating the monitoring level for each ID.

2.3 Anomaly Detection Processing Timing Identifying Information

FIG. 12 is a diagram illustrating an example of anomaly detectionprocessing timing identifying information. The anomaly detectionprocessing timing identifying information indicates the correlationbetween the monitoring level and the anomaly detection processingtiming, as illustrated in FIG. 12. The monitoring level deciding unit2156 identifies the anomaly detection processing timing corresponding toa decided monitoring level in accordance with this anomaly detectionprocessing timing identifying information, and updates the correlationinformation which the anomaly detection processing timing holding unit144 holds so as to indicate the anomaly detection processing timing thathas been identified. In the example in FIG. 12, the monitoring level isdivided into four stages of 0 through 3. Note that this is but oneexample, and that the monitoring level may be section into any number ofstages.

The following processing is performed at the anomaly detection ECU 2100due to the anomaly detection processing timing identifying informationexemplarily illustrated in FIG. 12, in accordance with the monitoringlevel. That is to say, in a case where the monitoring level is 0, noanomaly detection processing is performed. In a case where themonitoring level is 1, an anomaly detection processing request signal isnotified to the anomaly detection processing unit 2154 at the time ofcompletion of reception of the data frame, and anomaly detectionprocessing is started. In a case where the monitoring level is 2, ananomaly detection processing request signal is notified to the anomalydetection processing unit 2154 at the time of ID reception (i.e., whenthe ID field of the data frame is received). In a case where themonitoring level is 3, an anomaly detection processing request signal isnotified to the anomaly detection processing unit 2154 at each point ofreceiving the ID, receiving the DLC (when receiving the field of theDLC), and receiving data (when receiving the data field), and anomalydetection processing is started. The anomaly detection processing isperformed while receiving the data frame in the case of monitoringlevels 2 and 3, so in a case where an anomaly is detected in the dataframe during the anomaly detection processing, the unauthorized dataframe can be invalidated by sending an error frame out onto the bus 300and overwriting the unauthorized data frame. An example is illustratedhere where the highest stage 3 of the four stages of monitoring levelperforms inspection quicker than or more wide-ranging than 0 through 2.Appropriately setting the monitoring level identified from the vehiclestate and the anomaly occurrence count, and the anomaly detectionprocessing timing is useful. Note that the content of the anomalydetection processing timing identifying information is not restricted tothe example illustrated in FIG. 12.

2.4 Method of Deciding Monitoring Level

FIGS. 13A through 13D are diagrams illustrating examples of tables usedby the monitoring level deciding unit 2156 for deciding the monitoringlevel. FIGS. 13A through 13D illustrate an example where a differenttable is set for each ID. FIG. 13A shows a table for identifying themonitoring level from the state of the vehicle and the number of timethat an anomaly has been detected (anomaly occurrence count) with regardto ID “0x100”, FIG. 13B ID “0x200”, FIG. 13C ID “0x300”, and FIG. 13D ID“0x400”. The monitoring level deciding unit 2156 decides the monitoringlevel in accordance with the state of the vehicle and the anomalyoccurrence count, following each of these tables. According to theexample in FIGS. 13A through 13D, if the state of the vehicle is stoppedwith regard to a data frame where the ID is 0x100, the monitoring levelis 0 regardless of how many times an anomaly has been detected. If thestate of the vehicle is charging with regard to a data frame where theID is 0x100, the monitoring level is decided to be 1 if the number oftime that an anomaly has been detected is four times or less, and themonitoring level is decided to be 3 if the number of time that ananomaly has been detected is five times or more. If the state of thevehicle is driving with regard to a data frame where the ID is 0x100,the monitoring level is decided to be 2 if the number of time that ananomaly has been detected is four times or less, and the monitoringlevel is decided to be 3 if the number of time that an anomaly has beendetected is five times or more. If the state of the vehicle is drivingat high speed with regard to a data frame where the ID is 0x100, themonitoring level is 3 regardless of how many times an anomaly has beendetected. The monitoring level is decided for the IDs 0x200, 0x300, and0x400, in the same way, based on the vehicle state and the anomalyoccurrence count. Note that the monitoring level for data frames ofwhich the ID is not in any of the tables in FIGS. 13A through 13D is setto 1. Appropriately setting the height of the monitoring level inaccordance with the necessity for monitoring due to anomaly detectionprocessing, for example, is useful.

The example of the table in FIG. 13A is an example assuming a case wherethe data frame of ID 0x100 is a control data frame relating to cruisecontrol, that is primarily transmitted while driving, regarding whichanomaly detection needs to be performed at a relatively high monitoringlevel while driving. The example of the table in FIG. 13B is an exampleassuming a case where the data frame of ID 0x200 is a data framerelating to charging control, regarding which anomaly detection needs tobe performed at a higher monitoring level while charging. The example ofthe table in FIG. 13C is an example assuming a case where the data frameof ID 0x300 is a data frame relating to remaining battery chargenotification. The example of the table in FIG. 13D is an exampleassuming a case where the data frame of ID 0x400 is a data framerelating to ECU state notification that will not affect vehicle controladversely right away, and in the case the anomaly occurrence countincreases, the monitoring level is raised, so as to maintain a safestate of the vehicle. Appropriately setting the monitoring level withregard to the relationship of vehicle state or anomaly occurrence count,in accordance with the characteristics of data frames distinguished byIDs, enables anomaly detection processing to be efficiently performedwith reduced electric power consumption.

2.5 Anomaly State Information

FIG. 14 is a diagram illustrating an example of anomaly stateinformation held by the anomaly state holding unit 2157. The anomalystate information is information recording the number of times thatanomalies have been detected (anomaly occurrence count) and the finalupdate time indicating the time at which the anomaly state informationwas last updated, for each data frame ID, as shown in FIG. 14. Thisanomaly state information is updated each time the anomaly detectionprocessing unit 2154 detects an anomaly in a data frame.

In the example in FIG. 14, the anomaly occurrence count is 0 times forthe data frames of IDs 0x100, 0x200, and 0x300, the final update time iswhen starting (e.g., when supply of power to the onboard network systemwas started), still set to the initial value set when starting. Withregard to the data frame where the ID is 0x400, the anomaly occurrencecount is 3 times, and the final update time is 20 minutes afterstarting.

2.6 Vehicle State Information

FIG. 15 is a diagram illustrating an example of vehicle stateinformation held in the vehicle state holding unit 2158. The vehiclestate information exemplarily illustrated in FIG. 15 indicates that thestate of the vehicle is charging. The vehicle state information isupdated by the frame processing unit 2152 acquiring the state of thevehicle by analyzing a data frame notified from the ECU 2200 c, andupdating the state of the vehicle as illustrated. The state of thevehicle may be one of the four of stopped, charging, driving, anddriving at high speed.

2.7 Monitoring Level Information

FIG. 16 is a diagram illustrating an example of the monitoring levelinformation that is held in the monitoring level holding unit 2159. Themonitoring level information indicates the monitoring level of each IDwith regard to data frames including that ID.

The example in FIG. 16 illustrates a state where the monitoring levelfor a data frame where the ID is 0x100 is 1, the monitoring level for adata frame where the ID is 0x200 is 2, the monitoring level for a dataframe where the ID is 0x300 is 3, and the monitoring level for a dataframe where the ID is 0x400 is 0. The monitoring level is divided intothe four stages of 0 through 3.

2.8 First Example of Operations of Anomaly Detection ECU 2100 thatChange According to Updating of Monitoring Level

FIG. 17 is a diagram illustrating an example of the operations of theanomaly detection ECU 2100 that change according to updating of themonitoring level. FIG. 17 illustrates an example of operations in a casewhere the monitoring level is updated in accordance with change of thestate of the vehicle. It will be assumed that the anomaly stateinformation held in the anomaly state holding unit 2157 of the anomalydetection ECU 2100 is in the state exemplarily illustrated in FIG. 14.At this time, the anomaly detection ECU 2100 has not detected a singleanomaly regarding a data frame of which the ID is 0x100.

First, a data frame notifying that the vehicle is stopped is sent outonto the bus 300 from the ECU 2200 c, as illustrated in FIG. 17. Theanomaly detection ECU 2100 receives this data frame, and thereby updatesthe vehicle state information to indicate stopped, and decides themonitoring level to be 0 for the data frame of which the ID is 0x100,based on the table exemplarily illustrated in FIG. 13A. Next, a dataframe of which the ID is 0x100 flows on the bus 300. The monitoringlevel for this data frame is 0, so the anomaly detection ECU 2100 doesnot perform anomaly detection processing. Next, upon the vehicle inwhich the onboard network system 11 is installed starts to drive, a dataframe notifying that the vehicle is driving is sent out onto the bus 300from the ECU 2200 c. The anomaly detection ECU 2100 receives this dataframe, and thereby updates the vehicle state information to indicatedriving, and decides the monitoring level to be 2 for the data frame ofwhich the ID is 0x100, based on the table exemplarily illustrated inFIG. 13A. Accordingly, the monitoring level of the anomaly detection ECU2100 regarding the data frame with the ID 0x100 is 2. Thus, when a dataframe of which the ID is 0x100 flows on the bus 300 next, this dataframe is subjected to anomaly detection processing (inspection todistinguish whether or not the ID is unauthorized, and whether or notthe data frame cycle is unauthorized) at the time of receiving the ID(See FIG. 12).

2.9 Second Example of Operations of Anomaly Detection ECU 2100 thatChange According to Updating of Monitoring Level

FIG. 18 is a diagram illustrating another example of the operations ofthe anomaly detection ECU 2100 that change according to updating of themonitoring level. FIG. 18 illustrates an example of operations in a casewhere the monitoring level is updated in accordance with an increase inthe number of times that anomalies are detected. It will be assumed thatthe anomaly state information held in the anomaly state holding unit2157 of the anomaly detection ECU 2100 is in the state exemplarilyillustrated in FIG. 14. At this time, the anomaly detection ECU 2100 hasalready detected anomalies regarding data frames of which the ID is0x400 three times.

First, a data frame notifying that the vehicle is driving is sent outonto the bus 300 from the ECU 2200 c, as illustrated in FIG. 18. Theanomaly detection ECU 2100 receives this data frame, and thereby updatesthe vehicle state information to indicate driving. The monitoring levelis 1 for the data frame of which the ID is 0x400, according to the tableexemplarily illustrated in FIG. 13D. Next, a data frame of which the IDis 0x400 flows on the bus 300. The monitoring level for this data frameis 1, so the anomaly detection ECU 2100 performs anomaly detectionprocessing at the time the reception of the data frame is complete, todistinguish whether or not the ID and DLC are unauthorized (see FIGS. 6and 12). Thereafter, second and third data frames with the ID 0x400 flowover the bus 300 (but these are data frames in which the DLC is anunauthorized value 8). As a result of anomaly detection processing, theanomaly detection ECU 2100 distinguishes that the data frames of ID0x400 received the second and third time are unauthorized since the DLCis 8. Accordingly, the anomaly state information is updated, and thenumber of times of detection of an anomaly reaches five, so themonitoring level goes to 3 (see FIGS. 13A through 13D). Thereafter, theanomaly detection ECU 2100 performs anomaly detection of data frameshaving the ID 0x400 during reception of the data frames (at the time ofreceiving the ID and at the time of receiving the DLC) (see FIGS. 6 and12). Accordingly, the data frame of ID 0x400 received the fifth time (adata frame where the DLC is an unauthorized value 8) is distinguished tobe an unauthorized DLC while receiving the data frame. The data frame isthus detected as being unauthorized, and an error frame is transmittedwhile receiving the data frame. Consequently, the unauthorized dataframe on the bus 300 is overwritten and invalidated.

Note that in this example, in a case where the vehicle state informationis driving, the anomaly detection processing timing holding unit 144updates the anomaly detection processing timing for ID 0x400 in thecorrelation information so that the more times anomalies are detected inthe anomaly state information (anomaly occurrence count), the more itemsof when receiving ID, when receiving DLC, when receiving data, and whenreception of data frame is completed, are used for the reception timing.That is to say, the number of anomaly detection processing timingsincreases from when reception of data frame is completed, to whenreceiving ID and when receiving DLC, due to the anomaly occurrence countincreasing. Thus, an arrangement may be made where the more timesanomalies are detected (anomaly occurrence count) for an ID in theanomaly state information, the more reception timings of when receivingID, when receiving DLC, when receiving data, and when reception of dataframe is completed, are correlated in the correlation information, foreach of the multiple IDs.

2.10 Processing at Time of Anomaly Detection ECU 2100 Receiving DataFrame

Processing performed at the time of the anomaly detection ECU 2100receiving a data frame will be described with reference to the flowchartin FIG. 19. Processing steps the same as the processing steps in theanomaly detection ECU 100 illustrated in the first embodiment (see FIG.9) are denoted with the same numerals, and description will be omittedas appropriate.

The anomaly detection ECU 2100 references the correlation informationheld by the anomaly detection processing timing holding unit 144 usingthe anomaly detection processing requesting unit 142, and decides theanomaly detection processing timing corresponding to the acquired ID ofthe data frame (step S1102). When the decided anomaly detectionprocessing timing has arrived (step S1103), the anomaly detection ECU2100 inputs an interruption request signal (anomaly detection processingrequest signal) to the processor of the microcontroller unit 2150 fromthe anomaly detection processing requesting unit 142 of the controllerunit 2140, thereby executing anomaly detection processing based onanomaly detection rules using the anomaly detection processing unit 2154(step S1106).

The anomaly detection ECU 2100 distinguishes whether or not an anomalyhas been detected as the result of anomaly detection processing (stepS2107), and in a case where an anomaly has been detected, updates theanomaly state information held by the anomaly state holding unit 2157(step S2108). That is to say, in a case where an anomaly has beendetected, the number of times of detection of an anomaly of a relevantID in the anomaly state information is incremented by 1. In a case ofdistinguishing in step S2107 that no anomaly was detected, the anomalydetection ECU 2100 transmission the processing to step S1105.

After updating the anomaly state information in step S2108, the anomalydetection ECU 2100 distinguishes whether or not the data frame is beingreceived (step S2109), and transmits an error frame to the bus 300 (stepS2110) only in a case where the data frame is being received.

2.11 Processing by Monitoring Level Deciding Unit 2156 of AnomalyDetection ECU 2100

FIG. 20 is a flowchart illustrating processing relating to decision ofmonitoring level by the monitoring level deciding unit 2156. Themonitoring level deciding unit 2156 judges whether or not updating ofthe anomaly state information has been notified from the anomalydetection processing unit 2154 or updating of the vehicle stateinformation has been notified from the frame processing unit 2152,awaits for notification, and repeats this judging (step S3001).

In a case where notification has been made of updating of the anomalystate information or the vehicle state information, the monitoring leveldeciding unit 2156 decides the monitoring level for each data frame ID,based on the anomaly state information and vehicle state information(step S3002).

Next, the monitoring level deciding unit 2156 confirms whether thedecided monitoring level has changed (been updated) from the previousmonitoring level by referencing the monitoring level holding unit 2159(step S3003). That is to say, the monitoring level deciding unit 2156compares the decided monitoring level with the previous monitoring levelthat the monitoring level information (see FIG. 16) held by themonitoring level holding unit 2159 indicates, and if these do not match,the monitoring level deciding unit 2156 determines that there has been achange from the previous monitoring level. If these match in thiscomparison, the monitoring level has not changed, so the monitoringlevel deciding unit 2156 ends the processing without updating themonitoring level information.

In a case of determining in step S3003 that the decided monitoring levelhas changed from the previous monitoring level, the monitoring leveldeciding unit 2156 updates the monitoring level information held by themonitoring level holding unit 2159 so as to indicate the decidedmonitoring level for each ID (step S3004).

After having updated the monitoring level information in step S3004, themonitoring level deciding unit 2156 notifies an updating request via thecontroller communication unit 151 (step S3005). By notifying this updaterequest, the monitoring level deciding unit 2156 rewrites the anomalydetection processing timing in the correlation information that theanomaly detection processing timing holding unit 144 of the controllerunit 2140 holds, based on the anomaly detection processing timingidentifying information (see FIG. 12) in accordance with the monitoringlevel.

2.12 Advantages of Second Embodiment

In the onboard network system 11 according to the second embodiment, theanomaly detection ECU 2100 decides an anomaly detection processingtiming in accordance with the ID of a received data frame, based oncorrelation information held in the anomaly detection processing timingholding unit 144, and performs anomaly detection processing at thedecided anomaly detection processing timing. Anomaly detectionprocessing is performed at suitable timings in accordance with the IDsof the data frames, so efficient detection of unauthorized frames can berealized. Further, the onboard network system 11 can change the anomalydetection processing timing in accordance with the state of the vehiclein which the onboard network system 11 is installed, and results ofanomaly detection processing, more specifically in accordance with themonitoring level decided from the state of the vehicle and the state ofanomaly. Accordingly, anomaly detection processing can be performed atappropriate timings according to the state of the vehicle and the stateof anomaly, and electric power consumption can be reduced.

Other Embodiments

The first and second embodiments have been described above as examplesof the art relating to the present disclosure. However, the art relatingto the present disclosure is not restricted to this, and also isapplicable to embodiments where modifications, substitutions, additions,omissions, and so forth have been performed as appropriate. For example,the following modifications are also included in an embodiment of thepresent disclosure.

(1) The anomaly detection processing requesting unit 142 has beendescribed above as deciding the anomaly detection processing timingbased on the correlation information, but the contents, format, and soforth of the correlation information can be optionally changed, and theanomaly detection processing timing may be determined individually foreach ID.

(2) The data frame in the CAN protocol has been described in the aboveembodiments in a standard ID format, but this may be an extended IDformat. In a case of an extended ID format, the ID of the data frame isrepresented by a total of 29 bits of the base ID at the ID position inthe standard ID format, and the extended ID.

(3) The anomaly detection processing timing has been described in theabove embodiments as being one of when receiving an ID, when receiving aDLC, when receiving data, and at the time of completion of region of thedata frame, but anomaly detection processing may be performed at timingsother than these. For example, in a case where the anomaly detectionrules (see FIG. 6) stipulate a value a predetermined number of bytesfrom the beginning of the data field (e.g., the highest-order one byte,etc.) as the rules for data regarding each ID, the anomaly detectionprocessing timing may be the time at which the predetermined number ofbytes (e.g., 1 byte) from the beginning of the data field was received,and not when receiving data, (i.e., not when the data field of the sizeindicated by the DLC has been received).

(4) Although description has been made in the above embodiments that ina case where an anomaly is detected regarding a data frame while theanomaly detection ECU 100 or 2100 is receiving the data frame, an errorframe is transmitted, an error frame does not necessarily have to betransmitted. The ECUs can be prevented from executing an unauthorizeddata frame by a method other than transmitting an error frame (e.g., bynotifying other ECUs over a communication path other than the bus 300,et.). Alternatively, the other ECUs may be notified that an anomaly hasbeen detected by the data frame, without notifying an error frame, andlong information may be recorded, information transmitted to an externalserver, or the like, as described above.

(5) In a case of the above-described anomaly detection processing unit154 or 2154 performing multiple inspections on a single data frame asanomaly detection processing, and in a case where the frame has beendetermined as being an unauthorized frame in one inspection thereof (ananomaly has been detected), the remaining inspections may be omitted.

(6) Description has been made in the above embodiments that the statesof the vehicle which the vehicle state information indicates is the fourstates of stopped, charging, driving, and driving at high speed, forexample, but other states may be indicated. Various types of states thatcan be identified by sensors, devices, or the like installed in thevehicle may be used as states of the vehicle in the vehicle stateinformation. For example, the state of the ignition key inserted intothe ignition key cylinder, the state of the gear position (e.g., inpark, neutral, first speed, second speed, and so forth), the networkload state of the bus 300 or the like, and so forth may be used asstates of the vehicle in the vehicle state information. Note that forthe state of the network load, the state of the bus load to which ECUsof a particular function classification are connected may be focused on,in accordance with the function classification of ECUs connected to eachof the busses making up the onboard network system 11, as a state of thevehicle in the vehicle state information. Examples of functionclassifications of ECUs include the “drive-related” which are functionsrelating to the vehicle driving, such as the engine, motor, fuel,battery, transmission, and so forth, “body-related” which are functionsrelated to control of the accessories such as door locks, the airconditioner, lights, turn indicators, and so forth. Besides the anomalydetection processing timing being decided in the correlation informationfor each ID, the anomaly detection processing timing may be decided foreach ID group made up of multiple IDs (e.g., a group sectioned byfunction classification of ECUs transmitting data frames of those IDs).

(7) Although the anomaly detection ECU 2100 has been described in theabove embodiments are acquiring data frames indicating the state of thevehicle from other ECUs via the bus, the state of the vehicle may beacquired some other way. For example, the state of the vehicle may beacquired by a dedicated communication path for notifying the state ofthe vehicle (e.g., a dedicated signal line or the like).

(8) Although description has been made in the above embodiments that thenumber of times an anomaly is detected by the anomaly detectionprocessing (anomaly occurrence count) is an example of a state ofanomaly to serve as the basis for the monitoring level for data framesof each ID, other than the anomaly occurrence count may be used as astate of anomaly. For example, a reliability of the ID, calculated basedon the results of anomaly detection processing, or the like, may beused.

(9) Although description has been made in the above embodiments that themonitoring level is decided in accordance with the state of vehicle andstate of anomaly, an arrangement may be made where the monitoring levelis decided according to, of these two, just the state of the vehicle.Alternatively, the monitoring level may be decided according to just thestate of anomaly. Also, a table (see FIGS. 13A through 13D) does notnecessarily have to be used to decide the monitoring level, and this maybe decided by computation (a function or the like) taking the state ofthe vehicle and the state of anomaly as input.

(10) Although description has been made in the above embodiments thatthe anomaly detection processing is performed by the microcontrollerunit 150 or 2150, the anomaly detection processing may be performed atthe controller unit 140 or 2140. Also, although description has beenmade in the above embodiments that the microcontroller unit 2150 decidesthe monitoring level, but the monitoring level may be decided by thecontroller unit 2140. Further, although description has been made in theabove embodiments that the microcontroller unit 2150 has the anomalystate holding unit 2157 and vehicle state holding unit 2158, thecontroller unit 140 or 2140 may have both or one of these.

(11) Although description has been made in the above embodiments thatthe anomaly state holding unit 2157 holds the final updated time, andjudgment to reset the anomaly occurrence count is performed by thedifference thereof as to the current time, the resetting may beperformed some other way. For example, a timer may be set at the time ofthe final update, and resetting be performed by the timer. Also, anarrangement may be made where the anomaly occurrence count is not reset,or where the anomaly state holding unit 2157 does not record the finalupdate time.

(12) Although description has been made in the above embodiments thatthe anomaly detection processing requesting unit 142 notifies theanomaly detection processing unit 154 or 2154 of an anomaly detectionprocessing request signal (specifically, inputs to the processor of themicrocontroller unit 150 or 2150) as an interruption request signal,notification of the anomaly detection processing request signal may beperformed by another method (e.g., a method of periodically querying theanomaly detection processing unit 154 or 2154 for an anomaly detectionprocessing request signal, or the like).

(13) Although description has been made in the above embodiments thatthe anomaly detection processing unit 154 or 2154 acquire informationnecessary for anomaly detection processing via the controllercommunication unit 151, communication may be directly made with thecontroller unit 140 or 2140, so as to acquire information necessary forprocessing. This acquisition may be realized by providing a separatecommunication path (dedicated signal line or the like) from thecommunication path, for the controller communication unit 151 toexchange signals with the controller unit 140 or 2140, for example.

(14) The anomaly detection processing unit 2154 has been described inthe above embodiments as notifying the monitoring level deciding unit2156 of having updated the content (anomaly state information) of theanomaly state holding unit 2157, but this notification of updating doesnot have to be performed. Similarly, the frame processing unit 2152 doesnot have to notify of updating of the vehicle state. Although themonitoring level deciding unit 2156 has been described in the aboveembodiments as deciding the monitoring level at the time of having beennotified of updating of the state of the vehicle or the state ofanomaly, deciding of the monitoring level is not restricted to thistime. For example, the monitoring level deciding unit 2156 mayperiodically decide the monitoring level.

(15) Although the monitoring level deciding unit 2156 has been describedin the above embodiments as updating the content (correlationinformation) of the anomaly detection processing timing holding unit 144via the controller communication unit 151, the correlation informationmay be updated by direct communication with the controller unit 140 or2140. This updating may be realized by providing a separatecommunication path (dedicated signal line or the like) from thecommunication path, for the controller communication unit 151 toexchange signals with the controller unit 2140, for example.

(16) Although the anomaly detection ECU and other ECUs in the aboveembodiments have been described as having digital circuits such as aprocessor, memory, and so forth, analog circuits, communicationcircuits, and so forth, the ECUs may include other hardware componentsuch as a hard disk, display, keyboard, mouse, and so forth. Thefunctions thereof may be realized by dedicated hardware (digitalcircuits and so forth) instead of realizing the functions by software bya control program stored in memory being executed by the processor.

(17) Part or all of the components of which the above-described devicesare configured may be configured as one system Large Scale Integration(LSI). A system LSI is a super-multifunctional LSI fabricated withmultiple components integrated on a single chip, and specifically is acomputer system configured including a microprocessor, ROM, RAM, and soforth. The RAM stores the computer program. The system LSI achieves itsfunctions by the microprocessor operating according to the computerprogram. The components of which the above-described devices areconfigured may each be independently formed as a single chip, or part orall may be included in a single chip. While a system LSI has beenmentioned, there are different names according to the degree ofintegration, such as IC, LSI, super LSI, and ultra LSI. The way in whichthe integrated circuit is formed is not restricted to LSIs, and may berealized by dedicated circuits or general-purpose processors. A FieldProgrammable Gate Array (FPGA) capable of being programmed aftermanufacturing the LSI, or a reconfigurable processor of which theconnections and settings of circuit cells within the LSI can bereconfigured, may be used. Moreover, in the event of the advent of anintegrated circuit technology which would replace LSIs by advance ofsemiconductor technology or a separate technology derived therefrom,such a technology may be used for integration of the functional blocks,as a matter of course. Application of biotechnology is a possibility.

(18) Part or all of the components of which the above-described devicesare configured may be configured as an IC card detachably mountable toeach device, or a standalone module. The IC card or standalone module isa computer system configured including a microprocessor, ROM, RAM, andso forth. The IC card or standalone module may include theabove-described super-multifunctional LSI. The IC card or standalonemodule achieves its functions by the microprocessor operating accordingto the computer program. The IC card or standalone module may betamper-resistant.

(19) The present disclosure may in one form be the anomaly detectionmethod illustrated in FIGS. 8 and 9, and so forth, for example, may be acomputer program which realizes these methods by a computer, or may bedigital signals made up of the computer program. The present disclosuremay be the computer program or the digital signals recorded in acomputer-readable recording medium, such as for example, a flexibledisk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD-RAM, BD (Blu-ray (aregistered trademark) Disc), semiconductor memory, or the like. Thepresent disclosure may also be the digital signals recorded in theserecording mediums. The present disclosure may be an arrangement wherethe computer program or the digital signals are transmitted over anelectric communication line, wireless or cable communication line, anetwork of which the Internet is representative, data broadcasting, orthe like. The present disclosure may be a computer system having amicroprocessor and memory, where the memory stores the computer program,and the microprocessor operates according to the computer program. Thismay also be carried out by another independent computer system, by theprogram or digital signals being recorded in the recording medium andbeing transported, or by the program or digital signals beingtransferred over the network or the like.

(20) The forms realized by optionally combining the components andfunctions exemplified in the above-described embodiments and theabove-described modifications are also included in the scope of thepresent disclosure.

This present disclosure is applicable to use for efficient detection oftransmission of unauthorized frames over a bus in an onboard networksystem according to CAN.

What is claimed is:
 1. An anomaly detection electronic controller thatperforms anomaly detection processing and that is connected to a bus,which a plurality of electronic controllers use for communication tocommunicate following a Controller Area Network (CAN) protocol, theanomaly detection electronic controller comprising: an anomaly detectionprocessor that performs anomaly detection processing regarding a dataframe; and an anomaly detection processing requester that decides ananomaly detection processing timing in accordance with a state of avehicle in which the bus is installed when receiving the data frame, theanomaly detection processing timing being a reception timing of one ormultiple fields in the data frame, wherein the anomaly detectionprocessor performs the anomaly detection processing regarding the dataframe at the anomaly detection processing timing decided by the anomalydetection processing requester.
 2. The anomaly detection electroniccontroller according to claim 1, wherein the anomaly detectionprocessing timing decided by the anomaly detection processing requesteris a timing after receiving an identifier (ID) of the data frame.
 3. Theanomaly detection electronic controller according to claim 1, whereinthe anomaly detection processing timing decided by the anomaly detectionprocessing requester is a timing after receiving a Data Length Code(DLC) field of the data frame.
 4. The anomaly detection electroniccontroller according to claim 1, wherein the anomaly detectionprocessing timing decided by the anomaly detection processing requesteris a timing after receiving a data field of the data frame.
 5. Theanomaly detection electronic controller according to claim 4, whereinthe anomaly detection processing timing decided by the anomaly detectionprocessing requester is a timing after receiving a predetermined numberof bytes from the beginning of a data field of the data frame.
 6. Theanomaly detection electronic controller according to claim 1, whereinthe anomaly detection processing timing decided by the anomaly detectionprocessing requester is a timing after completion of receiving the dataframe.
 7. The anomaly detection electronic controller according to claim1, further comprising: a microcontroller that is a semiconductorintegrated circuit including a microprocessor that executes a program;and a controller that is a semiconductor integrated circuit that isconnected to the microcontroller and that realizes functions of theanomaly detection processing requester, wherein the microprocessorrealizes the functions of the anomaly detection processor by performingthe anomaly detection processing in correlation with an interruptionrequest signal by executing the program, and wherein the anomalydetection processing requester sends out the interruption request signalto the microprocessor at the decided anomaly detection processingtiming.
 8. The anomaly detection electronic controller according toclaim 2, wherein, when the ID of the data frame is a first value, theanomaly detection processing timing by the anomaly detection processingrequester is a timing when receiving the data frame, and when the ID ofthe data frame is a second value that is different from the first value,the anomaly detection processing timing by the anomaly detectionprocessing requester is a timing after completion of receiving the dataframe, and wherein, in a case of having detected an anomaly in theanomaly detection processing performed by the anomaly detectionprocessor at the timing of receiving the data frame, the anomalydetection electronic controller sends out an error frame onto the bus.9. The anomaly detection electronic controller according to claim 1,wherein in a case of having detected an anomaly in the anomaly detectionprocessing, the anomaly detection processor notifies an error to atleast one of the plurality of electronic controllers.
 10. The anomalydetection electronic controller according to claim 1, wherein, in a caseof having detected an anomaly in the anomaly detection processing, theanomaly detection processor records information of the data frameregarding which the anomaly has been detected.
 11. The anomaly detectionelectronic controller according to claim 1, wherein, in a case of havingdetected an anomaly in the anomaly detection processing, the anomalydetection processor performs annunciation of the anomaly.
 12. Theanomaly detection electronic controller according to claim 1, wherein,in a case of having detected an anomaly in the anomaly detectionprocessing, the anomaly detection processor transmits the anomaly to anexternal server.
 13. An onboard network system including a plurality ofelectronic controllers that communicate via a bus following a ControllerArea Network (CAN) protocol, the onboard network system comprising: ananomaly detection processor that performs anomaly detection regarding adata frame; and an anomaly detection processing requester that decidesan anomaly detection processing timing in accordance with a state of avehicle in which the bus is installed when receiving a data frame, theanomaly detection processing timing being a reception timing of one ormultiple fields in the data frame, wherein the anomaly detectionprocessor performs anomaly detection processing regarding the data frameat the anomaly detection processing timing decided by the anomalydetection processing requester.
 14. An anomaly detection method used inan onboard network system including a plurality of electroniccontrollers that communicate via a bus following a Controller AreaNetwork (CAN) protocol, the method comprising: performing anomalydetection processing regarding a data frame; and deciding an anomalydetection processing timing in accordance with a state of a vehicle inwhich the bus is installed when receiving the data frame, the anomalydetection processing timing being a reception timing of one or multiplefields in the data frame, wherein the anomaly detection processingregarding the data frame is performed at the decided anomaly detectionprocessing timing.